Security

This page lays out security best-practices when running Synapse.

If you believe you have encountered a security issue, see our Security Disclosure Policy.

Content repository

Matrix serves raw, user-supplied data in some APIs — specifically the content repository endpoints.

Whilst we make a reasonable effort to mitigate against XSS attacks (for instance, by using CSP), a Matrix homeserver should not be hosted on a domain hosting other web applications. This especially applies to sharing the domain with Matrix web clients and other sensitive applications like webmail. See https://developer.github.com/changes/2014-04-25-user-content-security for more information.

Ideally, the homeserver should not simply be on a different subdomain, but on a completely different registered domain (also known as top-level site or eTLD+1). This is because some attacks are still possible as long as the two applications share the same registered domain.

To illustrate this with an example, if your Element Web or other sensitive web application is hosted on A.example1.com, you should ideally host Synapse on example2.com. Some amount of protection is offered by hosting on B.example1.com instead, so this is also acceptable in some scenarios. However, you should not host your Synapse on A.example1.com.

Note that all of the above refers exclusively to the domain used in Synapse’s public_baseurl setting. In particular, it has no bearing on the domain mentioned in MXIDs hosted on that server.

Following this advice ensures that even if an XSS is found in Synapse, the impact to other applications will be minimal.

Firewall configuration

If your Matrix server is secured by a firewall, firewall rules for two different purposes are required.

Client access to a Synapse server runs via the client port which is TCP port 443 by default. The client port has to be allowed inbound.

Federation to exchange messages with other Matrix servers runs via TCP port 8448 by default or alternatively via regular HTTPS TCP port 443 (usually if run with delegation and/or behind a reverse proxy). So to allow federation in a firewall, make sure to allow the federation port of your Synapse server inbound.

If you have outbound access limited by a firewall allowlist, make sure both TCP ports 443 and 8448 are allowed outbound.